The document provides an overview of the National Institute of Standards and Technology's (NIST) cloud computing program. It discusses NIST's role in advancing cloud computing standards through collaborative work with the private sector and federal agencies. It summarizes NIST's current tactical projects related to cloud computing guidance, reference architectures, and standards acceleration. It then outlines NIST's strategy to develop a US government cloud computing roadmap through an iterative three-step process of defining use cases, a reference architecture, and prioritized requirements.

1. NIST Cloud Computing
Program Overview
Presented by Dawn Leaf
NIST Senior Executive for Cloud Computing
November 4, 2010
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

2. National Institute of Standards and Technology (NIST)
Cloud Computing Role
NIST Cloud Computing efforts are consistent with the
NIST mission:
“To promote U.S. innovation and industrial
competitiveness by advancing measurement science,
standards, and technology in ways that enhance
economic security and improve our quality of life.”
Cornerstone: Advancing Standards Development
• government needs to work collaboratively with private sector
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

3. Goal of this briefing – summarize progress since May 2010
& set the stage for the next phase of our work together
How to build a roadmap
 Introduce NIST Strategic Cloud
Computing Initiative priorities
1. Define Target
USG Cloud risks
Computing obstacles
Business Use
Cases
Goal: Work together with Federal Chief 3. Generate Cloud
Computing Roadmap –
iteratively
Information Officers, Industry and Translate, Define &
Track Cloud Computing
2. Define Neutral
Standards Developing Organizations Cloud Computing
Priorities
Reference
to define a USG Cloud Computing Architecture and
Taxonomy
Roadmap
Concurrent & Iterative 3-step process
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

4. UPDATE: NIST Tactical projects
what we said we would do in May 2010… and what we’ve done
Special Publications:
1. SP 800 -125, DRAFT Guide to Security for Full Virtualization Technologies, July 2010
2. SP 800 – xxx, Cloud Computing Synopsis & Guidelines – Dec 2010 draft release
Complex Information Systems Measurement Science -- Cloud
Computing Simulation Model in Progress
Technical Advisor to Federal CIO Council Cloud Computing Executive
Steering Committee, Cloud Computing Advisory Council, Standards &
Security Working Groups
Standards Acceleration to Jumpstart Adoption of Cloud
Computing (SAJACC)
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

5. *
Cloud Computing Simulation Model goal & approach:
Understand & Predict Behavior in a Cloud Computing System
Koala – simulating an Infrastructure as a
service (IaaS) Cloud system
Objectives:
(1) Compare behavior of proposed resource
allocation algorithms for IaaS clouds
(2) Discover and characterize complex
behaviors that may emerge in IaaS clouds
Early 2011 -- Target timeframe to share initial project findings
Contributors: C. Dabrowski, J. Filliben, D. Genin, K. Mills & S. Ressler
*Previous work investigated proposed Congestion Control Mechanisms or the Internet –
see NIST Special Publication 500-282 http://www.nist.gov/itl/antd/Congestion_Control_Study.cfm
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

6. Update: Support to Federal CIO Council
Cloud Computing Advisory Council Security Working Group
Recommendations –
“Federal Risk & Authorization Management Program” concept
Technical Process: aligned to NIST SP 800-37 Guide for Applying the
Risk Management Framework to Federal Information Systems: A Security
Life Cycle Approach
Draft Security controls: selected from NIST SP 800-53
Recommended Security Controls for Federal Information Systems
• For low & moderate security impact cloud information systems
• Authorizing officials & information system owners have the authority &
responsibility to define requirements and security plans which define
how the controls are implemented.
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

7. Update: Standards Acceleration to Jumpstart Adoption of Cloud
Computing (SAJACC)
SAJACC goal is to help solve the problem:
“How do we support the adoption of a new complex
technology during the interim period between when
standards are needed and when they are available, and
how do we develop standards more quickly?”
SAJAAC is: Project, Process & Portal
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

8. SAJACC: What does it look like? Where are we?
Portal (version 1) NIST Cloud Community
Standards Outreach
Process
Sept. 2010 -- public
Internet accessible Existing Standards Enable
website Working Groups
Open, interoperable
information
Free Access.
cloud computing
Nov. 2010 -- populated before finalized
with draft use cases NIST Cloud Standards Portal standards
Use Cases
Plan -- iteratively & Faster standards
Validated “reference”
incrementally populate Specifications Implementations
portal development
specifications
• documented interfaces
Standards
• pointers - reference standards Development
implementations Organizations
• test results
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

9. NIST Strategy to Develop a Cloud Computing Roadmap
-- Why? Why Now?
• NIST Strategic & Tactical Cloud Computing
program initiated in parallel
• Tactical efforts are fundamental to support
adoption of any new emerging technology
• Tactical projects are necessary, but not sufficient to
aggressively respond to the rapid pace of
Cloud Computing services evolution
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

10. NIST Strategic Cloud Computing Program Timeline
May Nov March
2010 2010 2011
S
T Execute CC
R Outreach & Fact finding with Strategic
A USG, Industry, SDOs Launch CC program
T
Strategic
Evaluate past models & Program Continue
E
lessons learned Stakeholder
G
Initiate meetings
I
Stakeholder
C
Define fresh approach to meetings Integrate
support secure & results into
effective USG cloud tactical
computing adoption, priorities
prioritize interoperability, portability, &
security requirements, collaborate, more
NIST quickly respond to operational needs
CC
Definition
Tactical efforts
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

11. NIST Strategy to Develop a USG Cloud Computing Roadmap
1. Define Target
USG Cloud
Computing priorities
Business Use risks
Cases obstacles
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

12. NIST Strategy to Develop a USG Cloud Computing Roadmap
1. Define Target
USG Cloud
Computing priorities
Business Use risks
Cases obstacles
2. Define Neutral
Expanded
Cloud Computing CC Definition
Reference ref. architecture
Architecture Reference
& Taxonomy implementations
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

13. NIST Strategy to Develop a USG Cloud Computing Roadmap
1. Define Target
USG Cloud
Computing priorities
Business Use risks
Cases obstacles
3. Generate Cloud
Computing Roadmap
-- iteratively Translate,
Define & Track
Cloud Computing
Priorities
2. Define Neutral
Expand
Cloud Computing CC Definition
Reference ref. architecture
Architecture Reference
& Taxonomy implementations
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

14. NIST Strategy to Develop a USG Cloud Computing Roadmap
1. Define Target Prioritized Tactical
USG Cloud Requirements &
Computing priorities Deliverables
Business Use risks • Performance based
Cases obstacles interoperability, security,
3. Generate Cloud portability standards
requirements (SAJACC)
Computing Roadmap
-- iteratively Translate, •Guidance
Define & Track
Cloud Computing •Prototypes
Priorities
2. Define Neutral • Pilots
Expand
Cloud Computing CC Definition • R&D priorities
Reference ref. architecture
Architecture • Policies
Reference
& Taxonomy implementations
Information Technology Laboratory
NIST
National Institute of
Standards and Technology

15. Getting to Work -- November 5 Workshop
Overview:
• GSA related efforts,
• Lessons Learned,
• Review of the NIST Strategy to Develop a Cloud
Computing Roadmap; Process & Working logistics
Please sign up today for a Nov. 5 AM & PM
breakout TRACK AM PM
session Strategic USG Business Reference
Use Cases Architecture
Standards Cloud Standards SAJACC
Adoption Security Applications &
Considerations Issues
Information Technology Laboratory
NIST
National Institute of
Standards and Technology